IBM AIX pioout Arbitrary Library Loading Vulnerability
29 Jul. 2007
Summary
The pioout program is a setuid root application, installed by default under multiple versions of IBM AIX, that is used to interface with the printer driver.
Local exploitation of an arbitrary library loading vulnerability in the 'pioout' program, as included with IBM Corp.'s AIX operating system, allows an attacker to execute arbitrary code with root privileges.
Vulnerable Systems:
* AIX version 5.3 with service pack 6.
* (Previous versions may also be affected).
Exploitation of this vulnerability results in the execution of arbitrary code with root privileges.
The pioout program is setuid root, and executable by any user with local access. To exploit the vulnerability, all an attacker has to do is create a shared library that executes a shell.
Workaround:
Removing the setuid bit from the binary will prevent exploitation, but may make the program unusable by non-root users.
